Becoming An Effective ISO 13485:2016 Auditor 101

Becoming an EffectiveISO 13485:2016Auditor 101Planning and Conducting QMS Audits that Yield Useful Results(and Add Value to the Business)orielstat.com 800.472.6477

Conducting an ISO 13485 QMS internalaudit? Here’s how to prepare.CONGRATULATIONS! You have been chosen (or perhaps conscripted) to conductor participate in an ISO 13485 internal quality management system (QMS) audit.For many, the prospect of coordinating and conducting an audit can be terrifying.However, believe us when we say the terror subsides with each hour of planningyou do. In this white paper we will talk about how you can lay the foundation toensure that your ISO 13485 audit progresses smoothly, yielding input that’s usefulto your company’s management review as well as its corrective and preventiveaction (CAPA) processes.The Real Purpose of the Medical Device QMS AuditEven though it seems obvious, it’s worth repeating that the purpose of conducting an audit is todetermine whether the QMS conforms to specified requirements and is effective in enabling yourorganization to meet quality objectives. In other words, you are trying to assess whether the organization’s system says what it needs to say, that you’re doing what you say you’ll do, and that whatyou’re doing is working to produce the outcomes you need. A QMS audit is not intended to evaluatethe quality of products, nor does it focus on the performance of people. The emphasis is on the QMSprocesses and the effectiveness of the entire system in meeting defined requirements and objectives.A QMS audit is not intended to evaluate the quality of products, nor does it focus on theperformance of people. The emphasis is on the QMS processes and the effectiveness of the entiresystem in meeting defined requirements and objectives.On the following pages we share auditing best practices garnered from over 50 years of trainingQMS auditors and conducting audits on behalf of our customers.2orielstat.com   800.472.6477

Basic Types of ISO 13485 AuditsAudits are planned, systematic processes carried out according to prepared working documents and audit plans. ISO 13485 talks about two main components of internal audits (section 8.2.4): Confirming that the organization’s QMS documentation conforms to the standard and any applicable regulatory requirements – commonly called a documentation audit. Confirming that the organization has implemented and is maintaining the QMS documentation –commonly called an on-site audit.While documentation and on-site audits may seem like two entirely different animals, they are not.A thorough QMS audit includes both components. The difference between the two usually is in theapproach and depth to which each of these audit components is conducted. The focus of the documentation audit centers on whether the QMS has been established and documented, while the on-siteaudit looks at whether the QMS has been implemented and maintained.A full QMS audit has four primary goals:1. Determine the extent to which the QMS has been established.2. Determine whether or not the QMS has been documented in accordance with applicable requirements – also known as audit criteria (e.g., ISO standard, applicable regulations, contracts).3. Determine if the QMS has been effectively implemented.4. Determine whether or not the QMS has been properly maintained.DOCUMENTATION AUDITAUDITCRITERIA ISO STEM Policies (manual) System procedures Work instructions(as time permits)ON-SITE AUDITPRACTICES Records Observed behavior Interviews800.472.6477     orielstat.com3

Developing Your Overall ISO 13485Audit ScheduleA well-planned audit schedule will ensure that audits are performed regularly, are conductedaccording to the importance of the process, and address the results of previous audits.Developing a master audit schedule is the first step toward planning audit activities for the year.Individual audit leaders will construct the individual audit plans to meet the schedule. An example ofa master internal audit schedule is shown below. A similar one could be developed to plan yoursupplier audits for the year.A typical ISO 13485:2016 internal audit will generally cover 2-4 areas of the organization each month throughoutthe year, depending on the size of the company.AUDIT PROCESSESJANFEBMARAPRMAY Inspection – ProcessInspection – Final Standards Lab Testing Trainingorielstat.com   800.472.6477 Sales NOV Quality Control4OCT Quality AssuranceWarehousingSEP PurchasingShippingAUG Inspection – IncomingEngineeringJUL Contract AdministrationDesignJUN DEC

Preparing for Your ISO 13485 QMS AuditWhen planning an audit, it is tempting to skip some of the steps below and go immediately to creatinga checklist and schedule. However, the process of initiating the audit is vital to the audit’s success.Here are the steps you should take.12345Appoint the lead auditor. The first basic step is to figure out who will lead the audit team. Ifyou work for a small company, that might be you! This person will be responsible for allphases of the audit.Define audit objectives, scope, and criteria. This is an important step. You need to definewhich facilities and/or departments are involved and which processes will be audited. Defining the audit criteria (i.e., ISO 13485:2016) and additional applicable regulatory requirements(e.g., 21 CFR 820 and/or EU Medical Device Regulation 2017/745) is also imperative.Determine the feasibility of the audit. You need to ensure that you will be able to conductthe audit as planned. Will you have adequate cooperation from auditees? Are any of thepeople involved working on a major deadline that would take away from their participation?Will any of them be on vacation? Is there adequate time and budget to conduct the audit? Willall the information you need be made available to you? Don’t assume. Verify.Select the audit team. If your company is small, you may comprise the “team.” If yourcompany has more than, say, 150 employees, insources design, makes high risk-products,etc., it is possible that you may need 2 auditors on your team. In selecting the audit teammembers, consider which competencies are needed, how long your audit will last, the scopeof the audit, and time constraints. The first rule of auditing is that an auditor cannot examinean area for which he/she is responsible.Regarding competence, consider this example: An auditor who needs to interview management regarding management processes (e.g., resource processes, results processes, etc.)should have some minimal business experience. An auditor who needs to verify process orproduct measurements may need to have knowledge of quality and statistical tools. That’swhy ISO defines competence in terms of education, training, skill, experience, and personalattributes.Establish initial contact with the auditee(s). With a lead auditor chosen, the team determined,the scope defined, and other factors considered, it’s time establish contact with your auditees.Make sure affected members of your organization (or your supplier) understand the scope ofthe audit you are conducting, when the audit will be conducted, and who is on the team.Request access to all relevant documents and, if you are auditing a supplier, ask for a map orsketch of their facility that has the departments clearly labeled.800.472.6477     orielstat.com5

Conducting a QMS Documentation ReviewThe purpose of the documentation review is to determine whether or not the QMS has beenestablished and documented. Accordingly, where possible, try to review all documentation beforethe on-site audit activities commence. This will help you prepare for the on-site audit effectively andefficiently. Typically, auditees are required to submit a quality manual and procedures before theon-site audit.The documentation should cover relevant information regarding the QMS (e.g., scope, exclusionsthat may exist) and any additional requirements beyond ISO 13485 and applicable regulatoryrequirements (e.g., customer requirements and/or supplier agreements). It should represent thedocumented quality management system as required by ISO 13485 in paragraphs 4.2.1 and 4.2.2 orother applicable criteria. If you are auditing a supplier, sometimes it might not be possible to get thequality manual ahead of time for proprietary reasons. If that’s the case, allocate time for a review atthe beginning of the on-site audit. Organizational charts are helpful, so make sure you get a copy.In addition to the manual and procedures, review: Promotional literature and website pages Previous audit findings and status of corrective actions Supplier agreements (if auditing a supplier)Role of the Lead AuditorEvery audit has a lead auditor – even if it’s the only auditor! This person represents theteam in communication with the auditee and management. The lead auditor also defines therequirements of each audit assignment, including qualification of other audit team members.Here are some of the lead auditor’s additional responsibilities: Plan the audit. Assign audit responsibilities to each audit team member. Make effective use of resources during the audit. Organize and direct audit team members. Provide direction and guidance to auditors in training. Lead the audit team to reach conclusions. Prevent and resolve conflicts during the audit. Prepare and complete the audit report.6orielstat.com   800.472.6477

Creating the QMS Audit PlanStarting an on-site audit without a detailed plan is a surefire way to waste a lot of time, frustrate alot of people, and leave without generating useful output. In an ideal world, you should spend2 hours planning every hour of audit time. A detailed audit plan should cover: Audit objectives and scope Audit criteria and reference documents Locations, dates, times, and duration of audit activities Audit method to be used, including the extent of sampling Roles and responsibilities of the audit team members, guides, and observers Allocation of appropriate resources to critical areas of the audit Logistics and communications arrangements (usually for supplier audits)This is an example of an internal audit plan for a single internal process.AUDIT PLAN FOR ISO 13485PURPOSE: Quality System Evaluation ofDesign/Development Control for ISO 13485SCOPE: Design Control for Med-i-CareAUDITORSEPTEMBER 20, YYYY9–9:15J.T. Kirk (Lead)H. SuluAUDITEE: Dept. 31 – EngineeringREPRESENTATIVE: G. HillLEAD AUDITOR: J.T. KirkPRODUCT: Surgical ToolsOpeningMeeting9:30–10:3010:45–11:45Design and DevelopmentPlanning and FilesDesign and Development Transferand ChangeDesign Input/OutputDesign and Development Review,Design and DevelopmentVerification and ValidationOpening Meeting: 9:00 September 20, YYYYClosing Meeting: 12:30 September 20, YYYY12:30–1:30ClosingMeetingNote: List of applicable procedures to be audited is attached.J.T. KirkPrepared by:August 23, YYYYJ.T. KirkM. ScottApproved by:August 24, YYYYM. Scott800.472.6477     orielstat.com7